Executive brief
A vulnerability was identified in the Linux kernel's VFIO PCI driver, which is used for passing through hardware devices to virtual machines. A flaw in how the system manages power states could lead to inconsistent device behavior or system instability when hardware is reset or power settings are changed. This could potentially allow a local user to cause a denial-of-service condition by triggering unbalanced power management operations.
Technical details
A vulnerability in the Linux kernel's vfio-pci driver stems from how the 'disable_idle_d3' module parameter interacts with Runtime Power Management (PM). Originally, this parameter directly manipulated device power states, but the introduction of refcounted Runtime PM created a requirement for balanced 'get' and 'put' operations. Because the parameter was globally latched but could be modified via sysfs or module reloads, existing devices could end up with unbalanced PM refcounts. This could lead to devices being stuck in incorrect power states or kernel warnings/instability. The fix involves latching the 'disable_idle_d3' flag per-device at initialization to ensure consistent behavior throughout the device's lifecycle.
Affected products
- Linux Linux Kernel 7ab5e10eda02da1d9562ffde562c51055d368e9c
Timeline
- 2026-06-15: disclosed: Initial patch submitted by Alex Williamson
- 2026-07-18: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb
- https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3
- https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3
- https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8
- https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505
- https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2